rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix assume SAML required error redirect

Browse Source 
Signed-off-by: Émile Ré <emile@getprobo.com>
This commit is contained in:
Émile Ré
2026-02-18 15:13:24 +04:00
parent 2e1439b3f4
commit 00cc91c102
12 changed files with 340 additions and 102 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
pkg/iam/errors.go
View File

@@ -339,12 +339,11 @@ func (e *ErrPasswordRequired) Error() string {
}
type ErrSAMLAuthenticationRequired struct {
Reason string
RedirectURL string
Reason string
}
func NewSAMLAuthenticationRequiredError(reason string, redirectURL string) *ErrSAMLAuthenticationRequired {
return &ErrSAMLAuthenticationRequired{Reason: reason, RedirectURL: redirectURL}
func NewSAMLAuthenticationRequiredError(reason string) *ErrSAMLAuthenticationRequired {
return &ErrSAMLAuthenticationRequired{Reason: reason}
}
func (e *ErrSAMLAuthenticationRequired) Error() string {

3
pkg/iam/organization_service.go
View File

@@ -1301,7 +1301,8 @@ func (s OrganizationService) DeleteSAMLConfiguration(
func (s OrganizationService) ListSAMLConfigurations(
ctx context.Context,
organizationID gid.GID, cursor *page.Cursor[coredata.SAMLConfigurationOrderField],
organizationID gid.GID,
cursor *page.Cursor[coredata.SAMLConfigurationOrderField],
) (*page.Page[*coredata.SAMLConfiguration, coredata.SAMLConfigurationOrderField], error) {
var (
scope = coredata.NewScopeFromObjectID(organizationID)

7
pkg/iam/session_service.go
View File

@@ -549,12 +549,7 @@ func (s SessionService) AssumeOrganizationSession(
if err == nil && samlConfig.EnforcementPolicy == coredata.SAMLEnforcementPolicyRequired {
if rootSession.AuthMethod != coredata.AuthMethodSAML {
redirectURL, err := s.SAMLService.InitiateLogin(ctx, samlConfig.ID, continueURL)
if err != nil {
return fmt.Errorf("cannot initiate SAML login: %w", err)
}
return NewSAMLAuthenticationRequiredError("policy_requirement", redirectURL.String())
return NewSAMLAuthenticationRequiredError("policy_requirement")
}
} else if err == nil && samlConfig.EnforcementPolicy == coredata.SAMLEnforcementPolicyOptional {
// SAML is optional: both PASSWORD and SAML root sessions are allowed.

5
pkg/server/api/connect/v1/schema.graphql
View File

@@ -169,6 +169,10 @@ type Identity implements Node {
before: CursorKey
): PersonalAPIKeyConnection @goField(forceResolver: true)
ssoLoginURL: String
@goField(forceResolver: true)
@session(required: PRESENT)
permission(action: String!): Boolean!
@goField(forceResolver: true)
@session(required: PRESENT)
@@ -856,7 +860,6 @@ type PasswordRequired {
type SAMLAuthenticationRequired {
reason: ReauthenticationReason!
redirectUrl: String!
}
type AssumeOrganizationSessionPayload {

153
pkg/server/api/connect/v1/schema/schema.go
View File

@@ -154,6 +154,7 @@ type ComplexityRoot struct {
Permission func(childComplexity int, action string) int
PersonalAPIKeys func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey) int
Sessions func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.SessionOrder) int
SsoLoginURL func(childComplexity int) int
UpdatedAt func(childComplexity int) int
}
@@ -354,8 +355,7 @@ type ComplexityRoot struct {
}
SAMLAuthenticationRequired struct {
Reason func(childComplexity int) int
RedirectURL func(childComplexity int) int
Reason func(childComplexity int) int
}
SAMLConfiguration struct {
@@ -506,6 +506,7 @@ type IdentityResolver interface {
PendingInvitations(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.InvitationOrderBy) (*types.InvitationConnection, error)
Sessions(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.SessionOrder) (*types.SessionConnection, error)
PersonalAPIKeys(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.PersonalAPIKeyConnection, error)
SsoLoginURL(ctx context.Context, obj *types.Identity) (*string, error)
Permission(ctx context.Context, obj *types.Identity, action string) (bool, error)
}
type InvitationResolver interface {
@@ -895,6 +896,12 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
}
return e.complexity.Identity.Sessions(childComplexity, args["first"].(*int), args["after"].(*page.CursorKey), args["last"].(*int), args["before"].(*page.CursorKey), args["orderBy"].(*types.SessionOrder)), true
case "Identity.ssoLoginURL":
if e.complexity.Identity.SsoLoginURL == nil {
break
}
return e.complexity.Identity.SsoLoginURL(childComplexity), true
case "Identity.updatedAt":
if e.complexity.Identity.UpdatedAt == nil {
break
@@ -1871,12 +1878,6 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
}
return e.complexity.SAMLAuthenticationRequired.Reason(childComplexity), true
case "SAMLAuthenticationRequired.redirectUrl":
if e.complexity.SAMLAuthenticationRequired.RedirectURL == nil {
break
}
return e.complexity.SAMLAuthenticationRequired.RedirectURL(childComplexity), true
case "SAMLConfiguration.attributeMappings":
if e.complexity.SAMLConfiguration.AttributeMappings == nil {
@@ -2654,7 +2655,6 @@ type Mutation {
updateSCIMBridge(
input: UpdateSCIMBridgeInput!
): UpdateSCIMBridgePayload @session(required: PRESENT)
}
type Identity implements Node {
@@ -2696,6 +2696,10 @@ type Identity implements Node {
before: CursorKey
): PersonalAPIKeyConnection @goField(forceResolver: true)
ssoLoginURL: String
@goField(forceResolver: true)
@session(required: PRESENT)
permission(action: String!): Boolean!
@goField(forceResolver: true)
@session(required: PRESENT)
@@ -3383,7 +3387,6 @@ type PasswordRequired {
type SAMLAuthenticationRequired {
reason: ReauthenticationReason!
redirectUrl: String!
}
type AssumeOrganizationSessionPayload {
@@ -3500,8 +3503,6 @@ type RegenerateSCIMTokenPayload {
type UpdateSCIMBridgePayload {
scimBridge: SCIMBridge!
}
`, BuiltIn: false},
{Name: "../../../../gqlutils/directives/session/schema.graphql", Input: `# Session directive for GraphQL APIs
# Include this schema in your gqlgen configuration to enable session-based access control.
@@ -5587,6 +5588,53 @@ func (ec *executionContext) fieldContext_Identity_personalAPIKeys(ctx context.Co
return fc, nil
}
func (ec *executionContext) _Identity_ssoLoginURL(ctx context.Context, field graphql.CollectedField, obj *types.Identity) (ret graphql.Marshaler) {
return graphql.ResolveField(
ctx,
ec.OperationContext,
field,
ec.fieldContext_Identity_ssoLoginURL,
func(ctx context.Context) (any, error) {
return ec.resolvers.Identity().SsoLoginURL(ctx, obj)
},
func(ctx context.Context, next graphql.Resolver) graphql.Resolver {
directive0 := next
directive1 := func(ctx context.Context) (any, error) {
required, err := ec.unmarshalNSessionRequirement2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋgqlutilsᚋdirectivesᚋsessionᚐSessionRequirement(ctx, "PRESENT")
if err != nil {
var zeroVal *string
return zeroVal, err
}
if ec.directives.Session == nil {
var zeroVal *string
return zeroVal, errors.New("directive session is not implemented")
}
return ec.directives.Session(ctx, obj, directive0, required)
}
next = directive1
return next
},
ec.marshalOString2ᚖstring,
true,
false,
)
}
func (ec *executionContext) fieldContext_Identity_ssoLoginURL(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
fc = &graphql.FieldContext{
Object: "Identity",
Field: field,
IsMethod: true,
IsResolver: true,
Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
return nil, errors.New("field of type String does not have child fields")
},
}
return fc, nil
}
func (ec *executionContext) _Identity_permission(ctx context.Context, field graphql.CollectedField, obj *types.Identity) (ret graphql.Marshaler) {
return graphql.ResolveField(
ctx,
@@ -6320,6 +6368,8 @@ func (ec *executionContext) fieldContext_Membership_identity(_ context.Context,
return ec.fieldContext_Identity_sessions(ctx, field)
case "personalAPIKeys":
return ec.fieldContext_Identity_personalAPIKeys(ctx, field)
case "ssoLoginURL":
return ec.fieldContext_Identity_ssoLoginURL(ctx, field)
case "permission":
return ec.fieldContext_Identity_permission(ctx, field)
}
@@ -7130,6 +7180,8 @@ func (ec *executionContext) fieldContext_MembershipProfile_identity(_ context.Co
return ec.fieldContext_Identity_sessions(ctx, field)
case "personalAPIKeys":
return ec.fieldContext_Identity_personalAPIKeys(ctx, field)
case "ssoLoginURL":
return ec.fieldContext_Identity_ssoLoginURL(ctx, field)
case "permission":
return ec.fieldContext_Identity_permission(ctx, field)
}
@@ -10565,6 +10617,8 @@ func (ec *executionContext) fieldContext_Query_viewer(_ context.Context, field g
return ec.fieldContext_Identity_sessions(ctx, field)
case "personalAPIKeys":
return ec.fieldContext_Identity_personalAPIKeys(ctx, field)
case "ssoLoginURL":
return ec.fieldContext_Identity_ssoLoginURL(ctx, field)
case "permission":
return ec.fieldContext_Identity_permission(ctx, field)
}
@@ -11107,35 +11161,6 @@ func (ec *executionContext) fieldContext_SAMLAuthenticationRequired_reason(_ con
return fc, nil
}
func (ec *executionContext) _SAMLAuthenticationRequired_redirectUrl(ctx context.Context, field graphql.CollectedField, obj *types.SAMLAuthenticationRequired) (ret graphql.Marshaler) {
return graphql.ResolveField(
ctx,
ec.OperationContext,
field,
ec.fieldContext_SAMLAuthenticationRequired_redirectUrl,
func(ctx context.Context) (any, error) {
return obj.RedirectURL, nil
},
nil,
ec.marshalNString2string,
true,
true,
)
}
func (ec *executionContext) fieldContext_SAMLAuthenticationRequired_redirectUrl(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
fc = &graphql.FieldContext{
Object: "SAMLAuthenticationRequired",
Field: field,
IsMethod: false,
IsResolver: false,
Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
return nil, errors.New("field of type String does not have child fields")
},
}
return fc, nil
}
func (ec *executionContext) _SAMLConfiguration_id(ctx context.Context, field graphql.CollectedField, obj *types.SAMLConfiguration) (ret graphql.Marshaler) {
return graphql.ResolveField(
ctx,
@@ -13059,6 +13084,8 @@ func (ec *executionContext) fieldContext_Session_identity(_ context.Context, fie
return ec.fieldContext_Identity_sessions(ctx, field)
case "personalAPIKeys":
return ec.fieldContext_Identity_personalAPIKeys(ctx, field)
case "ssoLoginURL":
return ec.fieldContext_Identity_ssoLoginURL(ctx, field)
case "permission":
return ec.fieldContext_Identity_permission(ctx, field)
}
@@ -13495,6 +13522,8 @@ func (ec *executionContext) fieldContext_SignInPayload_identity(_ context.Contex
return ec.fieldContext_Identity_sessions(ctx, field)
case "personalAPIKeys":
return ec.fieldContext_Identity_personalAPIKeys(ctx, field)
case "ssoLoginURL":
return ec.fieldContext_Identity_ssoLoginURL(ctx, field)
case "permission":
return ec.fieldContext_Identity_permission(ctx, field)
}
@@ -13624,6 +13653,8 @@ func (ec *executionContext) fieldContext_SignUpFromInvitationPayload_identity(_
return ec.fieldContext_Identity_sessions(ctx, field)
case "personalAPIKeys":
return ec.fieldContext_Identity_personalAPIKeys(ctx, field)
case "ssoLoginURL":
return ec.fieldContext_Identity_ssoLoginURL(ctx, field)
case "permission":
return ec.fieldContext_Identity_permission(ctx, field)
}
@@ -13677,6 +13708,8 @@ func (ec *executionContext) fieldContext_SignUpPayload_identity(_ context.Contex
return ec.fieldContext_Identity_sessions(ctx, field)
case "personalAPIKeys":
return ec.fieldContext_Identity_personalAPIKeys(ctx, field)
case "ssoLoginURL":
return ec.fieldContext_Identity_ssoLoginURL(ctx, field)
case "permission":
return ec.fieldContext_Identity_permission(ctx, field)
}
@@ -17737,6 +17770,39 @@ func (ec *executionContext) _Identity(ctx context.Context, sel ast.SelectionSet,
continue
}
out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
case "ssoLoginURL":
field := field
innerFunc := func(ctx context.Context, _ *graphql.FieldSet) (res graphql.Marshaler) {
defer func() {
if r := recover(); r != nil {
ec.Error(ctx, ec.Recover(ctx, r))
}
}()
res = ec._Identity_ssoLoginURL(ctx, field, obj)
return res
}
if field.Deferrable != nil {
dfs, ok := deferred[field.Deferrable.Label]
di := 0
if ok {
dfs.AddField(field)
di = len(dfs.Values) - 1
} else {
dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
deferred[field.Deferrable.Label] = dfs
}
dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
return innerFunc(ctx, dfs)
})
// don't run the out.Concurrently() call below
out.Values[i] = graphql.Null
continue
}
out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
case "permission":
field := field
@@ -19919,11 +19985,6 @@ func (ec *executionContext) _SAMLAuthenticationRequired(ctx context.Context, sel
if out.Values[i] == graphql.Null {
out.Invalids++
}
case "redirectUrl":
out.Values[i] = ec._SAMLAuthenticationRequired_redirectUrl(ctx, field, obj)
if out.Values[i] == graphql.Null {
out.Invalids++
}
default:
panic("unknown field " + strconv.Quote(field.Name))
}

4
pkg/server/api/connect/v1/types/types.go
View File

@@ -180,6 +180,7 @@ type Identity struct {
PendingInvitations *InvitationConnection `json:"pendingInvitations,omitempty"`
Sessions *SessionConnection `json:"sessions,omitempty"`
PersonalAPIKeys *PersonalAPIKeyConnection `json:"personalAPIKeys,omitempty"`
SsoLoginURL *string `json:"ssoLoginURL,omitempty"`
Permission bool `json:"permission"`
}
@@ -387,8 +388,7 @@ type SAMLAttributeMappingsInput struct {
}
type SAMLAuthenticationRequired struct {
Reason ReauthenticationReason `json:"reason"`
RedirectURL string `json:"redirectUrl"`
Reason ReauthenticationReason `json:"reason"`
}
func (SAMLAuthenticationRequired) IsAssumeOrganizationSessionResult() {}

47
pkg/server/api/connect/v1/v1_resolver.go
View File

@@ -160,6 +160,50 @@ func (r *identityResolver) PersonalAPIKeys(ctx context.Context, obj *types.Ident
return types.NewPersonalAPIKeyConnection(page, r, obj.ID), nil
}
// SsoLoginURL is the resolver for the ssoLoginURL field.
func (r *identityResolver) SsoLoginURL(ctx context.Context, obj *types.Identity) (*string, error) {
if err := r.authorize(ctx, obj.ID, iam.ActionIdentityGet); err != nil {
return nil, err
}
identity := authn.IdentityFromContext(ctx)
count, err := r.iam.AccountService.CountSAMLConfigurationsForEmail(ctx, identity.EmailAddress)
if err != nil {
r.logger.ErrorCtx(ctx, "cannot count SAML configurations for email", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
if count != 1 {
if count == 0 {
return nil, graphql.ErrorOnPath(
ctx,
fmt.Errorf("no SAML configuration for email"),
)
}
return nil, graphql.ErrorOnPath(
ctx,
fmt.Errorf("multiple SSO configurations found for this domain. Please use your organization-specific SSO login URL"),
)
}
samlConfigs, err := r.iam.AccountService.ListSAMLConfigurationsForEmail(ctx, identity.EmailAddress)
if err != nil {
r.logger.ErrorCtx(ctx, "cannot list SAML configurations for email", log.Error(err))
return nil, gqlutils.Internal(ctx)
}
samlConfig := samlConfigs[0]
if samlConfig == nil {
r.logger.ErrorCtx(ctx, "cannot find SAML config")
return nil, gqlutils.NotFoundf(ctx, "cannot find SAML config")
}
loginURL := r.baseURL.WithPath("/api/connect/v1/saml/2.0/" + samlConfig.ID.String()).MustString()
return &loginURL, nil
}
// Permission is the resolver for the permission field.
func (r *identityResolver) Permission(ctx context.Context, obj *types.Identity, action string) (bool, error) {
return r.Resolver.Permission(ctx, obj, action)
@@ -749,8 +793,7 @@ func (r *mutationResolver) AssumeOrganizationSession(ctx context.Context, input
case errors.As(err, &errSAMLAuthenticationRequired):
return &types.AssumeOrganizationSessionPayload{
Result: types.SAMLAuthenticationRequired{
Reason: types.ReauthenticationReason(errSAMLAuthenticationRequired.Reason),
RedirectURL: errSAMLAuthenticationRequired.RedirectURL,
Reason: types.ReauthenticationReason(errSAMLAuthenticationRequired.Reason),
},
}, nil